3 ms·
Format String Attacks (2000)
- aragonite 2y agoPDF with the same content: http://forum.ouah.org/FormatString.PDF http://forum.ouah.org/FormatString.PDF
- nneonneo 2y agoThere’s a whole library (pwntools.fmtstr) to help automate the (tedious) process of building format string exploits: https://docs.pwntools.com/en/stable/fmtstr.html https://docs.pwntools.com/en/stable/fmtstr.html There’s a bunch of nice features in glibc that make exploiting format strings much easier. For example, it supports the %hn and %hhn modifiers for doing short-sized and byte-sized writes respectively. It also supports positional arguments (%N$x) so you can target arbitrary items on the stack without having to go through all the previous arguments first. Of course, it also sports mitigations for format string exploits too. IIRC, setting _FORTIFY_SOURCE to 2 or higher will cause it to abort if a %n placeholder is found in a format string and the string is in writable memory.
- zelcon 2y agoSomeone take C out behind the barn already